The following Privacy Policy (the “Policy”) – according to article 13 of General European Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as “GDPR”) aims at describing how the personal data of web site users (“you”) are processed and collected by browsing or using the website www.nhoa.energy (the “Website” or “Site”). For sake of clarity, this Policy does not cover the data processing underlying the job application(s) that you submit in the “Careers” section of the Website. For more information in this regard, please see the Applicant Privacy Policy. Please read this Policy carefully before using this Website because it explains how we will process personal data (the “Data”). When you fill in forms available on the Website to download content, your Data will be processed to provide access to such content and, where consent is given, for marketing purposes. Specific privacy notices may be displayed within the forms (so-called “just-in-time notices”) to provide additional information on the processing of your Data. NHOA Energy S.r.l. (hereinafter “NHOA” or the “Company”, “we”) subject to the direction and coordination of NHOA S.A., registered office at Milan, Piazzale Lodi, 3 – 20137 is Data Controller of the user Data gathered during the browsing activity on the Website and the provision of the related services. As for the information collected through the cookies, please refer to our Cookie Policy.

1. INFORMATION ABOUT THE PROCESSING OF PERSONAL DATA

Your Data will be processed as follows: 

Purpose	Data/ Data Categories	Legal basis
A) Deal with your enquiries and requests (e.g. if you were to contact us to ask for more information about our Company, we would need to process your contact details	Name, surname, email address	If you make your request / enquire in the context of potentially entering into a contract with us, this data processing is necessary in order to take steps at your request / enquire prior to entering into a contract. The failure to process your data (or at least your e-mail) will not let us answer you. In other circumstances, this data processing is based on our legitimate interests in responding to your enquiries and requests.
B) Send you our newsletter and marketing communications	Name, surname, email address, company name	This data processing will take place only with your prior and optional consent. Refusal does not affect access to content download.
C) Website maintenance and troubleshooting	Browsing data like e.g. IP address, location – country, information on pages you visited within the Website, access time on the Website, navigation time on each page, clickstream analysis	This data processing is based on our legitimate interests for the maintenance of the Website and when you report a problem with our Website.
D) Processing in the context of any corporate events (sale of the Company or going concerns), due diligence exercises	Data included in Company’s database collected from the Website	This data processing is based on our legitimate interests in managing possible corporate events.
E) Defend of our rights and interests and litigation management	Data which may be relevant to defend our rights and interests related to the Website (e.g. address, location – country, information on pages you visited within the Website, access time on the Website, navigation time on each page, clickstream analysis)	This data processing is based on our legitimate interest in defending its rights, interests, assets related to the Website and managing possible disputes, also potentially and whether inside or outside a court.
F) Allow you to download content and manage related requests (e.g. articles, white papers, datasheet	Name, surname, email address, company name	This data processing is necessary to provide you with the requested content and is based on the performance of a service requested by the data subject pursuant to Article 6(1)(b) GDPR. Failure to provide such data will prevent access to the content.
G) Analyse users’ interest in content (Lead Analysis – light profilation)	Data relating to downloaded content, contact details, interaction with content	This processing is based on the legitimate interest of the Company to improve its communication and marketing activities. This activity does not involve automated decision- making producing legal effects pursuant to Article 22 GDPR.

The Data may be processed in hardcopy, by automates or electronic means. 

2. HOW WE PROCESS PERSONAL DATA

The data processing carries out with information system and organizational and logical methods strictly related to indicated purposes and the Company implemented all technical and organizational security measures to ensure the confidentiality, integrity, availability and resilience of data processing, in compliance with the article 32 of GDPR.

3. DATA RETENTION

Your Data will be stored in compliance with the applicable laws, for a period of time not exceeding what is necessary to achieve the purposes for which they are processed. The criteria for determining the data retention period take into account the lawful processing period and applicable laws, the statute of limitation periods and the nature of legitimate interests where they are the legal basis of the processing. Your Data may be stored for a longer period than the one originally planned, in the event of any disputes or requests by the relevant authorities. The Data processed to provide the newsletter service as described above will be stored until you withdraw your consent. Data collected for content download purposes will be retained for the time strictly necessary to provide the requested service. Data processed for marketing purposes will be retained until consent is withdrawn and, in any case, for no longer than 24 months from collection, unless otherwise required by applicable law. Provided that your Data are only held for as long as necessary, they will be cancelled, aggregated or anonymized in a secure manner once they are no longer needed.

4. COMMUNICATION OF PERSONAL DATA

The Data will be disclosed to the persons authorized for the processing within the Company’s staff. The Data may be disclosed by the Company solely and exclusively for the purposes indicated and where necessary, to the following categories of subjects:

• where required, the competent judicial authorities;
• where required, public administrations and supervisory and control authorities;
• service suppliers (e.g. legal consultants, marketing consultants, CRM and email marketing platform providers);
• information technology suppliers (e.g. cloud and software suppliers). 

Your Data will not be publicly disclosed. Entities belonging to the categories listed above, may act, as the case may be, as data processors (and in this case they will receive appropriate instructions from the Company) or as autonomous data controllers.

5. DATA TRANSFER OUTSIDE THE EEA 

If this is instrumental to the pursuit of the purposes set out above, your Data may also be transferred abroad to companies located both within and outside the European Economic Area (EEA). Some of these jurisdictions may not guarantee the same level of data protection guaranteed by the European laws. In this case, the Company undertakes to ensure that the data is processed with the utmost confidentiality, stipulating, if necessary, agreements that guarantee an adequate level of protection and / or adopting the standard contractual clauses provided by the European Commission.

6. DATA SUBJECTS RIGHTS

At any time you will be entitled to exercise the following rights and therefore:

• obtain confirmation as to whether your Data are being processed, and, where that is the case, access to the Data, under Article 15 of GDPR (Right of access);

• obtain the rectification of inaccurate Data concerning you or, taking into account the purpose of the processing, the integration of incomplete Data under Article 16 of GDPR (Right to rectification);

• obtain the erasure of your Data where one of the grounds under Article 17 of GDPR applies (Right to be forgotten);

• obtain the restriction of processing your Data, when one or more of the cases under Article 18 of GDPR applies (Right to restriction);

• object to the processing of your Data on grounds relating to your particular position, where applicable, under Article 21 of GDPR (Right to object);

• receive your Data in a structured, commonly used and machine-readable format as well as to transmit those data to another controller in the cases and within the limits referred to in Article 20 of GDPR, where applicable (Right to data portability)

Moreover, where provided, you have the right to withdraw your consent to process your Data, at any time, without prejudice to the lawfulness of the processing based on the consent given before the withdrawal. According with the GDPR, the Company may not charge for complying with any of the requests mentioned in this paragraph, unless they are clearly unfounded or excessive and repetitive. Should you request more than one copy of your Data or in cases of excessive or unfounded requests, the Company may: (i) charge a reasonable expense, considering the administrative costs incurred to fulfil the request; or (ii) refuse to fulfil the request. In these cases the Company will inform you of the costs before fulfilling the request. The Company may ask for further information before fulfilling the requests if it needs to verify the identity of the person who has made them. To exercise your rights, you can send an email with the following subject “PRIVACY”, to  privacy@nhoa.energy. Remember that you can also use the unsubscribe link included in our newsletters. Without prejudice to any administrative or legal remedy, you also have the right to lodge a complaint to the relevant supervisory authority (further information about the supervisory authorities is available on the website https://edpb.europa.eu/about-edpb/about-edpb/members_en), if you believe that processing of your Data is in breach of the GDPR. With respect of Italy, more information is available on the website https://www.garanteprivacy.it/. In any case, the Company is interested in knowing the reasons for the complaint and requests that you use the above contact methods before turning to the authorities, in order to prevent and resolve any disputes, amicably and promptly.

7. LINKS TO THIRD PARTY WEBSITES

Third party websites accessible from this Website are under the third party responsibility. Company declines all responsibility concerning requests and/or provision of Data to third party websites. The Company does not control any data processing underlying such websites. This Website can also contain iFrames with content of third parties. Company is not responsible for third-party content presented in iFrames. The information presented therein is the sole responsibility of those website owners. Company has no control or responsibility for the content of independent websites and provides this external content to its visitors for their convenience. As a result, when you visit a page containing such content, you may be presented with cookies from these third party websites. Company does not control the distribution of these cookies. Please check the third party’s cookies policy and privacy policy for more information.

8. LINKS TO SOCIAL NETWORKS

Our website includes links to social networks. In order to protect your Data while visiting our Website we do not use social plugins. Instead HTML-links are embedded onto the Website, enabling easy sharing onto social media platforms. Embedding the link prevents a direct connection with various social media network servers when opening a page from our Website. When clicking on one of the buttons, a browser window opens and directs the user to the respective service provider website on which (after having logged in) for example, the “Like” or “Share” button can be used. For more information on the purpose and scope of data processing and further use of your Data by the provider and their websites as well as your rights and possible settings to protect your privacy, please refer to the data protection information of the respective service provider.

9. AMENDMENTS

The Company reserves the right to partly or fully amend the Privacy Policy, or simply to update its content (e.g. as a result of changes in applicable law). We will publish any update on this Website. You should therefore periodically review these for changes to our Privacy Policy.

10. CONTACTING US

NHOA Energy S.r.l., Milan, Piazzale Lodi, 3 – 20137, Italy. You can contact the Company writing to the following email address privacy@nhoa.energy.  UPDATED ON MARCH 2026